PockyAPP is the Pokecio community’s chat app built on the open Matrix protocol, running on the pokecio.com server.
Who processes your data
The controller of your personal data is Karel Zelenka, who runs the Pokecio service (dev@pokecio.com). For anything about your personal data, write to privacy@pokecio.com.
What data and why
Invite requests
When you email us for an invite, we process your email address and whatever you write in the message (such as your name and preferred username). It’s used only to send you an invite and stays in our inbox until we’ve handled the request. The legal basis is your request for an invite, that is, steps taken before creating an account.
Your pokecio.com account
For your account we process your username, password (stored only as a hash, never readable), display name and profile picture. The name and picture are stored on the Matrix server and visible to the people you talk to. For your account’s security, the Matrix server keeps track of your signed-in devices, including IP addresses and device types, so you can see and sign them out in the app. The legal basis is providing the service you ask for.
Messages and attachments
Messages, photos, voice messages and other attachments are stored on the Matrix server so the others in the conversation receive them. PockyAPP creates new chats and groups with end-to-end encryption turned on, so the server can’t see the content of messages or attachments. It does see metadata: who is in the conversation, when a message was sent, its size, typing and read status. In conversations without encryption (for example older ones created in another app) the content is readable on the server. If someone from another Matrix server is in the conversation, messages are stored there too, because that’s how Matrix works. The server keeps your key backup only encrypted with your recovery key.
Before sending, photos are stripped of hidden data (EXIF, including where they were taken), and so are MP4 videos.
Online status, typing and statuses
Whether others see that you’re online and typing is your choice in the app. The setting applies only to that device and works both ways: if you don’t share yours, you don’t see others’ either. A custom status (like “💻 At work”) is visible to the people you talk to and disappears after the time you set.
Location
Only you send your location, only to a specific chat, and only as precisely as you choose: exact, approximate (about 500 m) or city only (about 5 km). For approximate location the app rounds the real coordinates on your phone, so the exact spot never leaves your device. In encrypted chats the coordinates are encrypted. With live location the server additionally sees that you are sharing and until when, but not where you are. Live location runs only for the time you pick and you can stop it any time. Maps load from our own map server maps.pokecio.com, not from Google or any other company.
New message notifications
So that notifications reach Android even with the app closed, our server sends only a short signal through Google’s Firebase Cloud Messaging that something arrived in one of your chats. Google receives your device’s push identifier and technical identifiers of the message and conversation. We don’t send it the sender’s name, the conversation name or the message text. Your phone then fetches and decrypts the message itself. On phones without Google services, the app checks for messages on its own, without Firebase. The legal basis is delivering the messages you asked to receive. You can turn notifications off in Android settings; once the device is signed out, the identifier is deleted from the server.
App updates
Every 12 hours the Android app checks pokecio.com for a new version. It only downloads a public file with the version number and sends no identifier of your account or device. You can turn the check off in Settings → Updates.
Server logs
The server writes a technical record of every request, including your IP address and the time. We use it only to run and secure the service, for example to detect abuse or an attack, and keep it for at most 30 days. The legal basis is our legitimate interest in running the service safely; you can object to this processing.
On your device
The app stores your sign-in, settings and encryption keys on your phone. The sign-in is kept in Android’s encrypted storage and the app is excluded from backups. Choices like location precision or showing your online status are stored only on that device. The web app (app.pokecio.com) keeps your sign-in and keys in the browser’s storage. This website (pokecio.com) uses no cookies and no analytics.
Who your data is shared with
- Contabo GmbH (Germany), where our server running PockyAPP is hosted. The email we receive invite requests on runs on the same server. Contabo processes the data only on our behalf.
- Google (Firebase Cloud Messaging): the device identifier and technical message identifiers for Android notifications, as described above. Google may also process data in the USA, under the EU–US Data Privacy Framework.
- The other people in a conversation and their Matrix servers, as described above.
The server and email are in the European Union. Your data can leave the EU only as described above: when you talk to someone on a Matrix server outside the EU, or with notifications via Google. We don’t sell your data or use it for advertising.
Do you have to provide data?
No, but some of it is needed. Without an email we can’t send you an invite, and without a username and password you can’t have an account. Your name, profile picture, status and location are optional.
Automated decisions
We make no automated decisions about anyone and do no profiling. We don’t use data to evaluate your behaviour or for targeting.
How long
We keep account data and messages for as long as you have an account. Messages you’ve sent remain with the other people in the conversation, as is usual for chat. Invite requests are deleted once handled, and server logs after at most 30 days.
Your rights
You have the right to access your data, correct it, erase it, restrict its processing, port it and object. We’ll close your account and erase your data on request, just write to privacy@pokecio.com. If you think we’re not handling your data properly, you can contact the Czech Office for Personal Data Protection (uoou.gov.cz).
Age
PockyAPP is for people aged 15 and over, and we ask about age when you request an invite. If we find out an account belongs to someone younger, we close it and delete its data. If you’re a parent or guardian and find that your child under 15 has created an account, write to privacy@pokecio.com (their Pokecio address, e.g. @name:pokecio.com, is enough) and we’ll close the account along with its data.
Changes
PockyAPP is in open beta and this policy may change. The current version is always on this page; we’ll announce important changes in the app or on the website.